> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hexr.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Multi-Cloud Tool Access

> Access AWS, GCP, and Azure services from a single agent — no credentials in your code.

## The Problem

Traditional agents need cloud credentials hardcoded or injected via environment variables:

```python theme={null}
# ❌ The old way — credentials everywhere
import boto3
session = boto3.Session(
    aws_access_key_id="AKIA...",        # Leaked in git
    aws_secret_access_key="wJalr...",   # Rotated manually
)
```

## The Hexr Way

```python theme={null}
# ✅ The Hexr way — identity-based access
from hexr import hexr_agent, hexr_tool

@hexr_agent(name="multi-cloud-agent", tenant="acme-corp")
def main():
    # AWS — automatic STS credential exchange
    s3 = hexr_tool("aws_s3")
    obj = s3.get_object(Bucket="reports", Key="sales.csv")
    s3_data = obj["Body"].read()

    # GCP — automatic Workload Identity Federation
    bq = hexr_tool("gcp_bigquery")
    bq_data = bq.query("SELECT * FROM dataset.table LIMIT 10")

    # Azure — automatic federated identity
    blob_client = hexr_tool("azure_storage")
    blob = blob_client.get_blob_client(container="data", blob="report.pdf")
    blob_data = blob.download_blob().readall()
```

**Zero credentials in your code.** The platform exchanges your agent's SPIFFE identity for short-lived cloud tokens automatically.

***

## How It Works

<Steps>
  <Step title="Agent requests AWS tool">
    Your agent calls `hexr_tool("aws_s3", ...)`. The request goes through Envoy to the Credential Injector.
  </Step>

  <Step title="SPIFFE → AWS credential exchange">
    The Credential Injector calls AWS `AssumeRoleWithWebIdentity` with the JWT-SVID. AWS returns temporary credentials (15-minute TTL).
  </Step>

  <Step title="Agent requests GCP tool">
    Your agent calls `hexr_tool("gcp_bigquery", ...)`. Same flow through Envoy to the Credential Injector.
  </Step>

  <Step title="SPIFFE → GCP credential exchange">
    The Credential Injector calls GCP STS for token exchange. GCP returns an `access_token` (60-minute TTL).
  </Step>
</Steps>

```
Agent → Envoy → Credential Injector → AWS STS (15min creds) / GCP STS (60min token)
```

***

## Setup

### Build with Multi-Cloud

```bash theme={null}
hexr build agent.py --tenant acme-corp --multi-cloud aws,gcp,azure
```

### Cloud Provider Configuration

<AccordionGroup>
  <Accordion title="AWS">
    1. Create an IAM OIDC Identity Provider pointing to `oidc.hexr.cloud`
    2. Create an IAM Role with a trust policy for your agent's SPIFFE ID
    3. Configure the role ARN in Helm values:

    ```yaml theme={null}
    credentialInjector:
      aws:
        roleArn: arn:aws:iam::123456789:role/hexr-agent-role
    ```
  </Accordion>

  <Accordion title="GCP">
    1. Create a Workload Identity Pool
    2. Add an OIDC Provider pointing to `oidc.hexr.cloud`
    3. Create a service account and grant the pool access
    4. Configure in Helm values:

    ```yaml theme={null}
    credentialInjector:
      gcp:
        workloadIdentityProvider: projects/123/locations/global/workloadIdentityPools/hexr/providers/spire
    ```
  </Accordion>

  <Accordion title="Azure">
    1. Create an App Registration with Federated Identity Credentials
    2. Set the issuer to `oidc.hexr.cloud`
    3. Configure in Helm values:

    ```yaml theme={null}
    credentialInjector:
      azure:
        tenantId: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
        clientId: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
    ```
  </Accordion>
</AccordionGroup>

***

## Per-Process Cloud Access

In a CrewAI crew, each role can have different cloud permissions:

```python theme={null}
@hexr_agent(name="data-crew", tenant="acme", framework="crewai")
def main():
    # researcher → spiffe://.../data-crew/researcher → BigQuery read-only
    # writer → spiffe://.../data-crew/writer → S3 write-only
    # No code changes needed — OPA policies enforce the scoping
    ...
```